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DETAILED ACTION 

1. Claims 1-39 are pending in the application. 

2. Claims 1-39 have been rejected. 

Continued Examination Under 37 CFR LI 14 

3 . A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.114. Applicant's submission filed on 2/27/04 has been entered. 

Response to Arguments 

4. Applicant's arguments with respect to claims 1-39 have been considered but are moot in view 
of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or on 
sale in this country, more than one year prior to the date of application for patent in the United States. 

5. Claims 1, 4-6, 10, 12, 13, 15-20, 22-24, 32, 33, 36 and 39 rejected under 35 U.S.C. 102(b) 
as being anticipated by McNeill et al U.S. Patent No. 6,167,052. 

As to claims 1, 22 and 36, McNeill et al discloses a first device comprising a hardware- 
implemented firewall [column 9, lines 32-34]. McNeill et al discloses logic residing in the 
system other than on the communication device to allow the communication device to establish a 
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connection to the network provided the first device is in the system. McNeill et al discloses that 
the first device allows the host device to connect to the network using the communication device 
that does not itself have a firewall capability that is required by the network [column 10, lines 
46-55]. McNeill et al discloses that the system is configured to cause data transferred by the 
communication device to be processed by the firewall [column 9, lines 32-34]. McNeill et al 
discloses the limitation "only if a firewall device comprising a hardware implemented firewall is 
coupled to a host device" in claim 22 [column 3, lines 21-39]. As to claim 36, the examiner 
asserts that a NIC is a data interface for receiving and sending data. 

As to claim 4, McNeill et al discloses a server for providing policies to be used by the 
firewall and that the first device is operable to access the server to receive the policies [column 
11, lines 4-39]. 

As to claim 5, McNeill et al discloses that the system further comprises a plurality of 
nodes having a hardware-implemented firewall [column 4, lines 19-28]. McNeill et al discloses 
that the server is further operable to transfer the policies to the plurality of nodes and that the 
system comprises a centrally managed network having nodes with hardware implemented 
firewalls [column 11, lines 4-39]. 

As to claim 6, McNeill et al discloses that the logic to allow the system to establish a 
connection to the network comprises hardware implemented token [column 11, lines 40-59]. 

As to claim 10, McNeill et al discloses logic for preventing login of the host device 
unless the first device is coupled to the host device [column 12, lines 19-38]. 

As to claim 12, McNeill et al discloses that the first device is physically coupled to the 
communication device. McNeill et al discloses that the data transferred by the communication 
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device to the network is processed by the firewall before it is transferred into the network and the 
data transferred from the network to the communication device passes through the firewall 
before it reaches the host device [column 10, lines 30-43]. 

As to claim 13, McNeill et al discloses that the physical connection is of the same 
medium as the network connection [column 4, lines 19-28]. 

As to claim 15, McNeill et al discloses that the system further comprises a software 
driver in the host device and that the driver is operable to pass data that is received by the 
communication device to the first device to be processed by the firewall [column 5, lines 33-39]. 

As to claim 16, McNeill et al discloses that the software driver is further operable to pass 
data which is to be transferred by the communication device over the network to the first device 
to be processed by the firewall, as discussed above. 

As to claim 17, McNeill et al discloses a software component installed above a driver for 
the communication device, the software component operable to route data for the communication 
device to the first device [column 10, lines 46-55]. 

As to claim 18, Newton's defines a shim as a piece of software. Microsoft defines a 
miniport driver as a kernel-mode driver that is specific to a device. As to the limitation "said 
software component is a shim", TCP is the software component would have been the shim. The 
miniport driver would have been the driver for the NIC. The examiner asserts that TCP operates 
within an operating system. The examiner further asserts that an operating system resides above 
any drivers. 
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As to claim 19, McNeill et al discloses a software component installed below a driver for 
the communication device and that the software component is operable to route data for the 
communication device to the first device [column 14, lines 44-56]. 

As to claim 20, McNeill et al discloses transfer security logic residing on the first device. 
McNeill et al discloses that the transfer security logic is for securely transferring data between 
the first device and a server in the network [column 10, lines 15-24]. 

As to claims 23 and 33, McNeill et al discloses that the host device routes the data to the 
firewall device is to be processed by the hardware-implemented firewall, as discussed above. 
McNeill et al discloses that the routing takes place at a physical layer in the data stack [column 3, 
lines 40-53]. 

As to claim 24, McNeill et al discloses sending policies to the firewall device and that the 
operation of the hardware implemented firewall is modified [column 13, lines 7-26]. 

As to claim 32, McNeill et al discloses transferring data to be transferred over the 
network by the communication interface device to the firewall device, as discussed above. 
McNeill et al discloses processing the data with the hardware-implemented firewall, as discussed 
above. McNeill et al discloses that the data is processed by the hardware-implemented firewall 
before it is transferred over the network connection established via the communication interface 
device, as discussed above. 

As to claim 39, McNeill et al discloses that the hardware-implemented firewall is 
dedicated to the host device [column 3, lines 40-53]. 
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Claim Rejections - 35 USC § 103 
The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

6. Claims 2, 8, 9, 11, 21, 25 and 34 are rejected under 35 U.S.C 103(a) as being 
unpatentable over McNeill et al et al U.S. Patent No. 6,167,052 as applied to claims 1 and 22 
above, and further in view of Gleichauf et al U.S. Patent No. 6,324,656 Bl. 

As to claims 2, 1 1 and 25, McNeill et al does not teach logic for checking integrity of 
software components in the system. 

Gleichauf teaches logic for checking integrity of software components in the system. 
Gleichauf teaches that network devices are scanned for the potential vulnerabilities inherent to 
the services and the operating system of each device [column 5, lines 41-45]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified McNeill et al so that the computer implemented 
firewall would have performed a scan for the potential vulnerabilities to the services and the 
operating system for each device. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified McNeill et al by the teaching of Gleichauf is that each 
device connected to the network can identified and the appropriate vulnerabilities can be 
assessed [column 2, lines 51-54]. 
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As to claim 8, McNeill et al does not teach an alert log for logging possible breaches 
detected by the system. 

Gleichauf teaches an alert log for logging possible breaches detected by the system. 
Gleichauf teaches database 26 that can include potential vulnerabilities identified by the NVA 
engine 20 [column 4, lines 47-49]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified McNeill et al so that the computer implemented 
firewall would have performed a scan for the potential vulnerabilities and stored the potential 
vulnerabilities in a database. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified McNeill et al by the teaching of Gleichauf because it 
confirms identified potential vulnerabilities [column 2, lines 55-56]. 

As to claim 9, Gleichauf teaches a configuration integrity checker (i.e. NVA engine 20) 
for checking integrity of software components (i.e. operating system) in the system, wherein the 
possible breach is detected by the configuration integrity checker [Gleichauf column 5, lines 41- 
45]. 

As to claims 21 and 34, McNeill et al teaches server for providing policies to be used by 
the firewall [column 13, lines 7-26], 

McNeill et al does not teach a configuration integrity checker for checking integrity of 
software components in the system. McNeill et al does not teach an alert log for logging 
possible security breaches detected by the system. 
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Gleichauf teaches a configuration integrity checker for checking integrity of software 
components in the system. Gleichauf combination teaches a configuration integrity checker (i.e. 
NVA engine 20) for checking integrity of software components (i.e. operating system) in the 
system. Gleichauf teaches that the possible breach was detected by the configuration integrity 
checker [column 5, lines 41-45]. Gleichauf teaches an alert log for logging possible breaches 
detected by the system. Gleichauf teaches database 26 that can include potential vulnerabilities 
identified by the NVA engine 20 [column 4, lines 47-49]. Gleichauf teaches an alert log for 
logging possible security breaches detected by the system. Gleichauf teaches database 26 that 
can include potential vulnerabilities identified by the NVA engine 20 [column 4, lines 47-49]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified McNeill et al so that an NVA engine would have 
been included on the computer that the firewall resides. The NVA would have scanned the 
software components of the devices on the network and recorded a log for possible security 
breaches. The server of McNeill et al would have provided the policies for the NVA engine. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified McNeill et al by the teaching of Gleichauf is that each 
device connected to the network can identified and the appropriate vulnerabilities can be 
assessed [column 2, lines 51-54]. 

7. Claims 3 and 7 are rejected under 35 U.S.C. 103(a) as being unpatentable over McNeill 
et al et al U.S. Patent No. 6,167,052 as applied to claim 1 above, and further in view of Servi 
U.S. Patent No. 5,278,904. 
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As to claim 7, McNeill et al teaches that the second device is coupled to the first device, 
as discussed above. 

McNeill et al does not teach a second device having stored thereon data needed to 
establish the connection to the network. McNeill et al does not teach logic to allow the system to 
establish the connection and is operable to access the data to assure the first device must be in the 
system to establish the connection to the network via the communication device 

Servi teaches a stored password on a requesting node to access protected resources on a 
server node [column 1, lines 55-63]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified McNeill et al so that any of the firewall devices 
would have been authenticated by a stored password to receive policies from the security policy 
server. The password would have been stored data used to establish the connection to the 
network. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified McNeill et al is that this provides a method for reliable 
identification of a device attempting access to protected resources by a remote verifier using 
reduced communications [column 1, lines 45-47]. 

8. Claim 14 is rejected under 35 U.S.C. 103(a) as being unpatentable over McNeill et al et 
al U.S. Patent No. 6,167,052 as applied to claim 1 above, and further in view of Dempsey et 
al U.S. Patent No. 5,826,048. 
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As to claim 14, McNeill et al does not teach that the physical connection comprises an 
MPCI (Mini Peripheral Component Interconnect) adapter to couple the first device to the 
communication device. 

Dempsey teaches a MPCI interface for connecting a PCI bus to one or more external 
devices [column 2, lines 43-45]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified McNeill et al so that the MPCI interface would 
have connected the firewall to the NIC. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified McNeill et al by the teaching of Dempsey because it 
reduces the number of signals required in implementing a PCI compliant interface by 
multiplexing and subsequently de-multiplexing signals. It also can be used to interface non-PCI 
devices and bus, and can be adapted or modified to reduce the number of pins/signals associated 
with these devices and buses [column 3, lines 51-58]. 

9. Claim 26 is rejected under 35 U.S.C. 103(a) as being unpatentable over McNeill et al et 
al U.S. Patent No. 6,167,052 and Gleichauf et al U.S. Patent No. 6,324,656 Bl as applied to 
claim 22 above, and further in view of Watson et al U.S. Patent No. 5,475,839. 

As to claim 26, the McNeill-Gleichauf combination does not teach that the configuration 
integrity check is performed before the network connection is allowed and the connection is 
allowed only if the configuration integrity check passes. 

Watson teaches that tests are performed prior to or during the boot operation in order to 
determine whether selected programs and/or data files have been corrupted [column 3, lines 60- 
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63]. The examiner asserts that the boot operation takes place before a network connection takes 
place. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified the McNeill-Gleichauf combination so that tests 
are performed on the host device prior to or during the boot operation in order to determine if 
any data files have been corrupted. If anything were corrupted the boot process would have been 
interrupted. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified the McNeill-Gleichauf combination by the teaching of 
Watson because it allows the user to boot the system from a known, uncorrupted set of files in 
the event the system is corrupted [column 3 line 67 to column 4 line 3]. 

10. Claims 27 and 28 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
McNeill et al et al U.S. Patent No. 6,167,052 and Gleichauf et al U.S. Patent No. 6,324,656 
Bl as applied to claim 22 above, and further in view of Fischer U.S. Patent No. 5,475,826. 

As to claim 27, the McNeill-Gleichauf combination does not teach that performing a hash 
on the software component to produce a hash value and comparing the hash value with a stored 
hash value to perform the configuration integrity check. 

Fischer teaches it is well known that file integrity is protected by taking a one-way hash 
(e.g., by using MD5 or the secure hash algorithm SHA) over the contents of the file. By 
implementing and checking a currently computed hash value, with a previously stored hash 
value, correct file integrity assures the threat of malicious tampering (or even accidental 
external modification) can be detected-thereby improving the reliability and security of 
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ultimate results. Assuming it is stored in a way that preserves its own integrity, the file hash 
can be used to insure that the entire file has not been damaged or deliberately tampered [column 
1, lines 37-47]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified the McNeill-Gleichauf combination so that a hash 
on the software component is done to produce a hash value and compared with a stored hash 
value on the firewall to perform the configuration integrity check. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified the McNeill-Gleichauf combination by the teaching of 
Fischer because for massive re-computation for each file alteration, long periods in which the file 
is in jeopardy of being considered "invalid" if the application or system is abruptly terminated, 
additional storage space for a hash (or MAC) for each record, and the ability of an adversary to 
substitute stale records because the integrity of the entire file, and the inter-relationship of all 
records is maintained encapsulated in a single file HASH value which changes as each file 
update is performed [column 3, lines 48-57]. 

As to claim 28, the McNeill-Gleichauf-Fischer combination that the stored hash value 
resides on the firewall device, as discussed above. 

11. Claims 29, 30 and 35 are rejected under 35 U.S.C 103(a) as being unpatentable over 
McNeill et al et al U.S. Patent No. 6,167,052 and Gleichauf et al U.S. Patent No. 6,324,656 
Bl as applied to claim 22 above, and further in view of Daniel et al U.S. Patent No. 
4,823,345. 
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As to claims 29 and 35, the McNeill-Gleichauf combination does not teach sending an 
alert if the configuration integrity check fails. 

Daniel teaches a generic alert code generation and identification method and apparatus 
that can identify a particular generic alert [column 2, lines 15-20]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was to have modified the McNeill-Gleichauf combination so that an alert is 
generated if the integrity check fails. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified the McNeill-Gleichauf combination by the teaching of 
Daniel et al because an administrator or user would want an alert to know when something is 
corrupt in a network device. 

As to claim 30, the McNeill-Gleichauf-Daniel combination teaches storing an alert if the 
configuration integrity check fails [Daniel et al column 3, lines 44-59]. 

12. Claims 31 is rejected under 35 U.S.C. 103(a) as being unpatentable over McNeill et al 
et al U.S. Patent No. 6,167,052 and Gleichauf et al U.S. Patent No. 6,324,656 Bl as applied 
to claim 25 above, and further in view of Uceda-Sosa et al U.S. Patent No. 6,496,840 Bl. 

As to claim 31, the McNeill-Gleichauf combination teaches that host device treats the 
communication interface device as the firewall device and vice versa, as discussed above. The 
McNeill-Gleichauf combination teaches that the communication interface device transferring 
data received from the network in to the firewall device, wherein the firewall device processes 
the data with the hardware implemented firewall, as discussed above. 
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The McNeill-Gleichauf combination does not teach swapping resource spaces in the host 
device that are reserved for the communication interface device and the firewall device. 

Uceda-Sosa teaches executing a current modification request on one or more resources of 
a backup resource group; and atomically swapping the modified backup resource group and a 
current resource group, such that the modified backup resource group becomes the current 
resource group [column 1, lines 34-45]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was to have modified the McNeill-Gleichauf combination so that the 
resources would have been swapped in the host device that was reserved for the communication 
device and the firewall device so that the NIC would have been the firewall. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified the McNeill-Gleichauf combination by the teaching of 
Uceda-Sosa because it provides a platform independent, application-level technique that 
provides all-or-nothing semantics at the atomicity level of the underlying operating system, by 
providing a fixed-size naming scheme and a technique that determines which version of the 
resource group is the current version [column 5, lines 8-18]. 

13. Claims 37 is rejected under 35 U.S.C. 103(a) as being unpatentable over McNeill et al 
et al U.S. Patent No. 6,167,052 as applied to claim 36 above, and further in view of Fischer 
U.S. Patent No. 5,475,826. 

As to claim 37, McNeill et al does not teach logic for performing a configuration integrity 
check of software component. McNeill et al does not teach that the logic is operable to produce 
a numeric value that results from the check. McNeill et al does not teach a stored value for each 
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software component to be checked for integrity. McNeill et al does not teach logic to compare 
the produced value with the stored value. 

Fischer teaches it is well known that file integrity is protected by taking a one-way hash 
(e.g., by using MD5 or the secure hash algorithm SHA) over the contents of the file. By 
implementing and checking a currently computed hash value, with a previously stored hash 
value, correct file integrity assures the threat of malicious tampering (or even accidental external 
modification) can be detected-thereby improving the reliability and security of ultimate results. 
Assuming it is stored in a way that preserves its own integrity, the file hash can be used to insure 
that the entire file has not been damaged or deliberately tampered [column 1, lines 37-47]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to have modified McNeill et al so that a hash on the software 
component is done to produce a hash value and compared with a stored hash value on the 
firewall to perform the configuration integrity check. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified McNeill et al by the teaching of Fischer because massive 
re-computation for each file alteration, long periods in which the file is in jeopardy of being 
considered "invalid" if the application or system is abruptly terminated, additional storage space 
for a hash (or MAC) for each record, and the ability of an adversary to substitute stale records 
because the integrity of the entire file, and the inter-relationship of all records is maintained 
encapsulated in a single file HASH value which changes as each file update is performed 
[column 3, lines 48-57]. 
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14. Claim 38 is rejected under 35 U.S.C. 103(a) as being unpatentable over McNeill et al et 
al U.S. Patent No. 6,167,052 as applied to claim 36 above, and further in view of Servi U.S. 
Patent No. 5,278,904. 

As to claim 38, McNeill et al teaches that a user would have to provide proof that he is 
authorized to initiate a connection [column 11, lines 4-21] 

McNeill et al does not teach that the first logic comprises stored values to be used in an 
authentication process during establishment of the network connection. 

Servi teaches a stored password on a requesting node to access protected resources on a 
server node [column 1, lines 55-63]. 

Therefore, it would have been obvious to a person having ordinary skill in the art at the 
time the invention was made to modify McNeill et al so that any of the firewall devices would 
have been authenticated by a stored password to establish a network connection. 

It would have been obvious to a person having ordinary skill in the art at the time the 
invention was made to have modified McNeill et al by the teaching of Servi because this 
provides a method for reliable identification of a device attempting access to protected resources 
by a remote verifier using reduced communications [column 1, lines 45-47]. 
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Conclusion 



15. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Aravind K Moorthy whose telephone number is 703-305-1373. 
The examiner can normally be reached on Monday-Friday, 8:00-5:30. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz R Sheikh can be reached on 703-305-9648. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 



Aravind K Moorthy 
March 17, 2004 



